So, having issues getting the correct print size from Eagle PCB on printer.  These steps seem to work for me

• Create the board in Eagle
• Turn off all layers except those wanted, ie Top, Pads, Vias
• File -> Export -> Image
  • Resolution: 600
  • Select Monochrome
  • Give a file name
  • Click OK
• Open file in Gimp
  • Image -> Crop to Content
  • If need to invert image, ie Top mask overlay (Flip Horizontally & Flip vertically), Colors -> Invert
• Save modified image
• Print
  • Page Setup tab
    • Ensure scale is 100%
  • Image Settings tab
    • Draw Crop marks (if needed)
  • Color Tab
    • Monochrome
  • Advanced
    • Print Scaling: None
    • Print Optimization: Graphics
  • Press Print

When getting a new module/board, you need to load code into it.  After the code is created in ESPHome, download it for manual install, then use the following command to load it into the chip

esptool.py --chip auto -p /dev/ttyUSB0 write_flash 0x0 ~/snap/chromium/current/Downloads/file.bin

Needed to set up getting email from Office365 for some DMARC reports through Elastic.  Parsedmarc requires a connection to an IMAP server, so what do you do, then when the account is on Office 365, and you need to use MFA, and app passwords are disabled.

So, a program that can do this is DAVmail.  It can run in headless mode, and do the bridge of IMAP from client, and EWS using MFA.  I used Docker to run the application.

This is my docker-compose file

version: '2.2'
  services:
    davmail:
      container_name: "davmail"
      image: kran0/davmail-docker:latest
      ports:
        - 1143:1143
      volumes:
        - ./davmail/davmail.properties:/davmail/davmail.properties
        - /var/log/davmail365:/var/log/davmail
      restart: always

The davmail\davmail.properties file starts off list this.  This will enable you to test the connection using standard IMAP, if you are able to do it (account without MFA).

# DavMail settings, see http://davmail.sourceforge.net/ for documentation

#############################################################
# Basic settings

# Server or workstation mode
davmail.server=true
# Exchange/Office 365 connection mode:
# - O365Modern Office 365 modern authentication (Oauth2)
# - O365Interactive Office 365 with interactive browser window, not available in headless mode (OpenJFX required)
# - O365Manual Office 365 with interactive dialog, not available in headless mode
# - O365 Office 365 EWS mode
# - EWS Exchange 2007 and later
# - WebDav Exchange 2007 and earliear WebDav mode
# - Auto WebDav mode with EWS failover
davmail.mode=EWS
# base Exchange OWA or EWS url
davmail.url=https://outlook.office365.com/EWS/Exchange.asmx

# Listener ports
#davmail.caldavPort=1080
davmail.imapPort=1143
#davmail.ldapPort=1389
#davmail.popPort=1110
#davmail.smtpPort=1025

#############################################################
# Network settings

# Network proxy settings
davmail.enableProxy=false
davmail.useSystemProxies=false
davmail.proxyHost=
davmail.proxyPort=
davmail.proxyUser=
davmail.proxyPassword=

# proxy exclude list
davmail.noProxyFor=

# allow remote connection to DavMail
davmail.allowRemote=true
# bind server sockets to a specific address
davmail.bindAddress=
# client connection timeout in seconds - default 300, 0 to disable
davmail.clientSoTimeout=

# DavMail listeners SSL configuration
davmail.ssl.keystoreType=
davmail.ssl.keystoreFile=
davmail.ssl.keystorePass=
davmail.ssl.keyPass=

# Accept specified certificate even if invalid according to trust store
davmail.server.certificate.hash=

# disable SSL for specified listeners
davmail.ssl.nosecurecaldav=false
davmail.ssl.nosecureimap=true
davmail.ssl.nosecureldap=false
davmail.ssl.nosecurepop=false
davmail.ssl.nosecuresmtp=false

# disable update check
davmail.disableUpdateCheck=true

# Send keepalive character during large folder and messages download
davmail.enableKeepAlive=true
# Message count limit on folder retrieval
davmail.folderSizeLimit=0
# Default windows domain for NTLM and basic authentication
davmail.defaultDomain=

#############################################################
# Caldav settings

# override default alarm sound
davmail.caldavAlarmSound=
# retrieve calendar events not older than 90 days
davmail.caldavPastDelay=90
# EWS only: enable server managed meeting notifications
davmail.caldavAutoSchedule=true
# WebDav only: force event update to trigger ActiveSync clients update
davmail.forceActiveSyncUpdate=false

#############################################################
# IMAP settings

# Delete messages immediately on IMAP STORE \Deleted flag
davmail.imapAutoExpunge=true
# Enable IDLE support, set polling delay in minutes
davmail.imapIdleDelay=
# Always reply to IMAP RFC822.SIZE requests with Exchange approximate message size for performance reasons
davmail.imapAlwaysApproxMsgSize=

#############################################################
# POP settings

# Delete messages on server after 30 days
davmail.keepDelay=30
# Delete messages in server sent folder after 90 days
davmail.sentKeepDelay=90
# Mark retrieved messages read on server
davmail.popMarkReadOnRetr=false

#############################################################
# SMTP settings

# let Exchange save a copy of sent messages in Sent folder
davmail.smtpSaveInSent=true

#############################################################
# Loggings settings

# log file path, leave empty for default path
davmail.logFilePath=/var/log/davmail.log
# maximum log file size, use Log4J syntax, set to 0 to use an external rotation mechanism, e.g. logrotate
davmail.logFileSize=1MB
# log levels
log4j.logger.davmail=WARN
log4j.logger.httpclient.wire=WARN
log4j.logger.org.apache.commons.httpclient=WARN
log4j.rootLogger=WARN

#############################################################
# Workstation only settings

# smartcard access settings
davmail.ssl.pkcs11Config=
davmail.ssl.pkcs11Library=

# SSL settings for mutual authentication
davmail.ssl.clientKeystoreType=
davmail.ssl.clientKeystoreFile=
davmail.ssl.clientKeystorePass=

# disable all balloon notifications
davmail.disableGuiNotifications=false
# disable tray icon color switch on activity
davmail.disableTrayActivitySwitch=false
# disable startup balloon notifications
davmail.showStartupBanner=true

# enable transparent client Kerberos authentication
davmail.enableKerberos=false

log4j.logger.org.apache.commons.httpclient=WARN
log4j.logger.httpclient.wire=WARN
log4j.rootLogger=WARN
log4j.logger.davmail=DEBUG

If the account has MFA then the above config will work if App Passwords are allowed.  If they are not allowed, then it wont work.  To get this working, you need to change the line

`davmail.mode=EWS` to `davmail.mode=O365Modern`.

Set the account to use the Microsoft Authenticator for MFA.  Then connect to the davmail output, and you should see it pop up with a URL during signin

https://login.microsoftonline.com/common/oauth2/authorize?client_id=UUID HERE&response_type=code&redirect_uri=https%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Foauth2%2Fnativeclient&response_mode=query&login_hint=useraccount&resource=https%3A%2F%2Foutlook.office365.com

At this point, copy the URL into a browser and authenticate.  You will be prompted for MFA.  Accept the permissions that are being added to the account for DAVmail.  The browser will stay at a blank screen.

To continue on, but may not be accurate.  I noticed that it was polling for MFA again, so accepted, and then away it goes – IMAP through MFA account.

DAVmail will keep the token renewed, so that is great.

Modifed the filebeat NGINX module, as the access log was extended to include upstream metrics.

log_format log_requests '$remote_addr - $remote_user [$time_local] "$request" '
                        '$status $body_bytes_sent "$http_referer" '
                        '"$http_user_agent" '
                        '"$host" $SSL_protocol "$SSL_cipher" "$upstream_addr" '
                        'rt=$request_time uct=$upstream_connect_time '
                        'uht=$upstream_header_time urt=$upstream_response_time';

This is basically the combined log format with the additional metrics of

• host – server block name, ie www.thesmithcave.nz
• $SSL_protocol – TLS protocol, ie TLSv1.2
• $SSL_cipher – Cipher used for the SSL connection
• $upstream_addr – backend server IP Address
• $rt, uct,uht and urt as time values

To be able to use this with Elastics filebeat module requires a few changes to the ingest pipeline.  The changes are as follows:

• Add a replacement to replace rt=-, uct=-, uht=- or urt=- to be =0 instead of =-
• Added additional GROK pattern to parse the above

NOTE:  If the module is updated, then the ingest pipeline will need to be modified before ingestion occurs

The full file of /usr/share/filebeat/module/nginx/access/ingest/pipeline.yml:

description: Pipeline for parsing Nginx access logs. Requires the geoip and user_agent
  plugins.
processors:
- set:
    field: event.ingested
    value: '{{_ingest.timestamp}}'
- gsub:
    field: message
    pattern: "urt=-"
    replacement: "urt=0"
- gsub:
    field: message
    pattern: "uht=-"
    replacement: "uht=0"
- gsub:
    field: message
    pattern: "uct=-"
    replacement: "uct=0"
- gsub:
    field: message
    pattern: "rt=-"
    replacement: "rt=0"
- grok:
    field: message
    patterns:
    - (%{NGINX_HOST} )?"?(?:%{NGINX_ADDRESS_LIST:nginx.access.remote_ip_list}|%{NOTSPACE:source.address}) - (-|%{DATA:user.name}) \[%{HTTPDATE:nginx.access.time}\] "%{DATA:nginx.access.info}" %{NUMBER:http.response.status_code:long} %{NUMBER:http.response.body.bytes:long} "(-|%{DATA:http.request.referrer})" "(-|%{DATA:user_agent.original})" "%{DATA:url.host}" %{DATA:tls.protocol} "%{DATA:tls.cipher}" "%{DATA:nginx.upstream.backend}" rt=%{NUMBER:nginx.request.time:float} uct=%{NUMBER:nginx.upstream.connect.time:float} uht=%{NUMBER:nginx.upstream.header.time:float} urt=%{NUMBER:nginx.upstream.response.time:float}
    - (%{NGINX_HOST} )?"?(?:%{NGINX_ADDRESS_LIST:nginx.access.remote_ip_list}|%{NOTSPACE:source.address})
      - (-|%{DATA:user.name}) \[%{HTTPDATE:nginx.access.time}\] "%{DATA:nginx.access.info}"
      %{NUMBER:http.response.status_code:long} %{NUMBER:http.response.body.bytes:long}
      "(-|%{DATA:http.request.referrer})" "(-|%{DATA:user_agent.original})"
    pattern_definitions:
      NGINX_HOST: (?:%{IP:destination.ip}|%{NGINX_NOTSEPARATOR:destination.domain})(:%{NUMBER:destination.port})?
      NGINX_NOTSEPARATOR: "[^\t ,:]+"
      NGINX_ADDRESS_LIST: (?:%{IP}|%{WORD})("?,?\s*(?:%{IP}|%{WORD}))*
    ignore_missing: true
- grok:
    field: nginx.access.info
    patterns:
    - '%{WORD:http.request.method} %{DATA:url.original} HTTP/%{NUMBER:http.version}'
    - ""
    ignore_missing: true
- remove:
    field: nginx.access.info
- split:
    field: nginx.access.remote_ip_list
    separator: '"?,?\s+'
    ignore_missing: true
- split:
    field: nginx.access.origin
    separator: '"?,?\s+'
    ignore_missing: true
- set:
    field: source.address
    if: ctx.source?.address == null
    value: ""
- script:
    if: ctx.nginx?.access?.remote_ip_list != null && ctx.nginx.access.remote_ip_list.length > 0
    lang: painless
    source: >-
      boolean isPrivate(def dot, def ip) {
        try {
          StringTokenizer tok = new StringTokenizer(ip, dot);
          int firstByte = Integer.parseInt(tok.nextToken());
          int secondByte = Integer.parseInt(tok.nextToken());
          if (firstByte == 10) {
            return true;
          }
          if (firstByte == 192 && secondByte == 168) {
            return true;
          }
          if (firstByte == 172 && secondByte >= 16 && secondByte <= 31) {
            return true;
          }
          if (firstByte == 127) {
            return true;
          }
          return false;
        }
        catch (Exception e) {
          return false;
        }
      }
      try {
        ctx.source.address = null;
        if (ctx.nginx.access.remote_ip_list == null) {
          return;
        }
        def found = false;
        for (def item : ctx.nginx.access.remote_ip_list) {
          if (!isPrivate(params.dot, item)) {
            ctx.source.address = item;
            found = true;
            break;
          }
        }
        if (!found) {
          ctx.source.address = ctx.nginx.access.remote_ip_list[0];
        }
      }
      catch (Exception e) {
        ctx.source.address = null;
      }
    params:
      dot: .
- remove:
    field: source.address
    if: ctx.source.address == null
- grok:
    field: source.address
    patterns:
    - ^%{IP:source.ip}$
    ignore_failure: true
- remove:
    field: message
- rename:
    field: '@timestamp'
    target_field: event.created
- date:
    field: nginx.access.time
    target_field: '@timestamp'
    formats:
    - dd/MMM/yyyy:H:m:s Z
    on_failure:
    - append:
        field: error.message
        value: '{{ _ingest.on_failure_message }}'
- remove:
    field: nginx.access.time
- user_agent:
    field: user_agent.original
    ignore_missing: true
- geoip:
    field: source.ip
    target_field: source.geo
    ignore_missing: true
- geoip:
    database_file: GeoLite2-ASN.mmdb
    field: source.ip
    target_field: source.as
    properties:
    - asn
    - organization_name
    ignore_missing: true
- rename:
    field: source.as.asn
    target_field: source.as.number
    ignore_missing: true
- rename:
    field: source.as.organization_name
    target_field: source.as.organization.name
    ignore_missing: true
- set:
    field: event.kind
    value: event
- append:
    field: event.category
    value: web
- append:
    field: event.type
    value: access
- set:
    field: event.outcome
    value: success
    if: "ctx?.http?.response?.status_code != null && ctx.http.response.status_code < 400" - set: field: event.outcome value: failure if: "ctx?.http?.response?.status_code != null && ctx.http.response.status_code >= 400"
- append:
    field: related.ip
    value: "{{source.ip}}"
    if: "ctx?.source?.ip != null"
- append:
    field: related.ip
    value: "{{destination.ip}}"
    if: "ctx?.destination?.ip != null"
- append:
    field: related.user
    value: "{{user.name}}"
    if: "ctx?.user?.name != null"
on_failure:
- set:
    field: error.message
    value: '{{ _ingest.on_failure_message }}'